apache / apache/cordova-plugin-inappbrowser
Throws error if embedded in iframe with different origin
- Dominant language
- Java
- Stars
- 1.1k
- Forks
- 2.2k
- PR merge metrics
- No merged PRs in 30d
Description
# Bug Report
## Problem
### What is expected to happen?
Embedded app in Iframe should load without errors
### What does actually happen?
https://github.com/apache/cordova-plugin-inappbrowser/blob/c54d10052a42d5e68c76b53991c287a19cdce12c/www/inappbrowser.js#L24-L27
this line throws the error
```bash
polyfills.5574a41….js:1 Uncaught DOMException: Blocked a frame with origin "https://websiteB" from accessing a cross-origin frame.
at https://websiteB/plugins/cordova-plugin-inappbrowser/www/inappbrowser.js:24:42
at https://websiteB/plugins/cordova-plugin-inappbrowser/www/inappbrowser.js:125:3
at e (https://websiteB/cordova.29dc09fa9fc3a7aeb58c.js:1:277)
at https://websiteB/cordova.29dc09fa9fc3a7aeb58c.js:1:379
at Object.t.mapModules (https://websiteB/cordova.29dc09fa9fc3a7aeb58c.js:1:12468)
at https://websiteB/cordova.29dc09fa9fc3a7aeb58c.js:1:11719
at a.r (https://websiteB/cordova.29dc09fa9fc3a7aeb58c.js:1:6215)
at a.fire (https://websiteB/cordova.29dc09fa9fc3a7aeb58c.js:1:7764)
at https://websiteB/cordova.29dc09fa9fc3a7aeb58c.js:1:11686
at https://websiteB/cordova.29dc09fa9fc3a7aeb58c.js:1:14390
```
As iframes are not allowed to access parent frames:
https://developer.mozilla.org/en/docs/Web/HTML/Element/iframe#Scripting
## Information
This does occur if websiteA embeds websiteB and they do not share the same origin.
### Environment, Platform, Device
Since: https://github.com/apache/cordova-plugin-inappbrowser/pull/118
## Checklist
- [x] I searched for existing GitHub issues
- [x] I updated all Cordova tooling to most recent version
- [x] I included all the necessary information above
@paule96 @danielhabenicht
Contributor guide
Research direction
Start at www/inappbrowser.js lines 24-27 and reproduce the plugin inside an iframe where websiteA and websiteB have different origins. Investigate the cross-origin frame access reported there; done means the embedded app loads without the Uncaught DOMException in that setup.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- mobile-dev
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100